fix: add check for client authorization before retrieving token string

[Yuan325]

Previous refactoring (#2273) accidentally removed the authorization checks prior to token retrieval. This issue went unnoticed because the integration tests were disabled. I am re-adding the necessary checks.

[gemini-code-assist]

Summary of Changes

Hello @Yuan325, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request rectifies a security and functional regression by re-establishing crucial client authorization checks across various Cloud Healthcare API tools. The core change involves conditionally parsing bearer tokens only when client authorization is enabled, preventing unnecessary token operations and ensuring that API calls are properly authenticated and authorized as intended. This fix enhances the robustness and security posture of the affected tools.

Highlights

• Re-introduction of Client Authorization Check: A conditional check for client authorization (source.UseClientAuthorization()) has been re-added before attempting to parse a bearer token. This ensures that token retrieval only occurs when client authorization is explicitly required.
• Fix for Accidental Regression: This change addresses a regression introduced in a previous refactoring (refactor(sources/cloudhealthcare): move source implementation in Invoke() function to Source #2273) where the authorization checks were inadvertently removed, leading to potential issues if not properly handled.
• Consistent Application Across Cloud Healthcare Tools: The authorization check logic has been consistently applied across multiple Cloud Healthcare tools, including those for FHIR page fetching, patient operations, dataset/DICOM/FHIR store management, and DICOM instance/series/study searches.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request addresses a regression by re-introducing a necessary authorization check before parsing bearer tokens. The fix is applied consistently across 15 different tool implementations. The logic of the fix is correct. However, this change highlights a significant amount of code duplication for token handling across these files. I've added a review comment with a suggestion to refactor this duplicated logic into a single helper function to improve the overall maintainability of the codebase.